CVE-2018-8172: Microsoft Expression Blend

High severity, CVSS 7.8. EPSS: 32.8% chance of exploitation in the next 30 days.

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio, Expression Blend 4.

Affected products

• Microsoft Expression Blend: version 2 only; version 3 only; version 4 only
• Microsoft Visual Studio: version 2010 only; version 2012 only; version 2013 only; version 2015 only
• Microsoft Visual Studio 2017: affected versions not specified; version 15.7.5 only

Published 2018-07-11. Last modified 2026-06-17.